in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law1 instrument, 1 in force
Research summary (286 words)
The Federated States of Micronesia has no comprehensive private-sector data-protection statute, no biometric-specific law, no breach-notification duty, and no dedicated data-protection supervisory authority. FSM Congress Bill C.B. No. 24-17 (24th Congress, First Regular Session, 2025) was introduced on to enact a Personal Data Protection Act as chapter 1 of Title 16 of the Code.
On its own applicability section it applies only to core National Government departments and agencies that collect, use, store, process, disclose, or transfer personal data, so it places no duty on a private business. Title 21 of the Code, as amended by Public Law 18-52 (the FSM Telecommunications Act of 2014), does hold a sector duty: section 349 bars a telecommunications licensee from collecting, using, maintaining or disclosing information about a customer without the customer's consent.
Section 349 also lets a customer inspect the licensee's records about that customer and requires the licensee to correct information shown to be incorrect. Section 350 requires a licensee to take all reasonable steps to ensure the confidentiality of its customers' communications except as permitted by law. Public Law 18-52 became law on presidential approval, dated .
Chapter 1 of Title 21 (the Radio Communication Act of 1991) has as its only communications-privacy-adjacent rule section 105, which prohibits a person from intercepting, divulging, or using an unauthorized foreign or interstate radio communication, a rule that reaches radio-transmission content generally rather than personal data specifically and carries no lawful-basis, data-subject-rights, cross-border-transfer, or supervisory structure of the kind this topic tracks.
Section 351 of Title 21 leaves untouched the rights of government authorities under the laws of the Federated States of Micronesia to access otherwise confidential information or communications in a lawful manner.
Section 349(1) of Title 21 bars a licensee from collecting, using, maintaining or disclosing information about a customer for any purpose without the customer's consent, and requires appropriate security safeguards against collection, use, maintenance or disclosure without that consent.
Section 349(4) requires a licensee to permit a customer to inspect its records regarding the communications service provided to that customer and to promptly correct or remove information that is shown to be incorrect. Section 349(6) requires a licensee, on request, to disclose to a customer the purpose of requesting or collecting any information about that customer, and bars it from using or maintaining customer information for undisclosed purposes.
Section 350 requires a licensee to take all reasonable steps to ensure the confidentiality of its customers' communications, and bars it from divulging information concerning a customer's communications without the customer's prior consent unless required by law or authorized by the Authority. Section 351 leaves untouched the rights of government authorities under the laws of the Federated States of Micronesia to access otherwise confidential information or communications in a lawful manner. The Act defines a licensee as a person who holds or is registered under a licence issued under the Act.
The Federated States of Micronesia has no scraping-specific statute, so general law governs each dimension separately.
The national Crimes title (Title 11) has no computer-misuse or unauthorized-access offense; FSM Congress Bill C.B. No. 24-14 (Cybersecurity Act 2025), which would add a new Chapter 4 to Title 21, would regulate only the cybersecurity practices of an owner of designated critical information infrastructure, not create a general offense reaching a person who reads or crawls an ordinary public web page.
No FSM court has addressed the enforceability of a browsewrap or clickwrap terms-of-service against a scraper, or established an unfair-competition, misappropriation, or trespass doctrine for scraping, and no source assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
The FSM Copyright Act (Title 35, Chapter 1) permits fair use for purposes including criticism, comment, and research, but contains no text-and-data-mining-specific exception or opt-out, so relying on fair use to train a model on scraped copyrighted text rests on the same general, multi-factor test as any other use.
The Act protects an original compilation as a literary work reaching only the compiler's own selection and arrangement, and confers no separate sui generis database right of the kind some other jurisdictions recognise. The Federated States of Micronesia has no comprehensive or sectoral privacy law reaching personal data scraped from a public FSM website (see this jurisdiction's privacy-topic finding).
Section 106 of the FSM Copyright Act gives a copyright owner the exclusive right to reproduce, prepare derivative works from, distribute, perform, and display a copyrighted work, subject to section 107's fair-use exception, which reaches reproduction for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, weighed against the purpose and commercial character of the use, the nature of the work, the amount used, and the effect on the work's market.
No text-and-data-mining-specific exception or opt-out mechanism exists in the chapter. Section 101 defines a compilation as an original work of authorship formed by selecting, coordinating, or arranging preexisting material or data, and section 103 confines a compilation's copyright to the compiler's own contribution, not the underlying material, so the Act confers no separate sui generis database right over data a scraper collects.
Willful infringement for commercial advantage or private gain is a criminal offense (section 123), and any infringement of the exclusive rights arms the copyright owner with a civil action for an injunction, damages, and court-imposed punitive damages (section 122); the chapter's own text does not state the calendar date on which it took effect.
Cybersecurity law3 instruments, 1 in force, 2 proposed
Research summary (840 words)
The Federated States of Micronesia's one enacted operator-facing security-posture duty for a private-sector duty-bearer sits inside its general telecommunications regulatory law, and a second, broader critical-infrastructure cybersecurity framework appears in a bill introduced in its national legislature.
The FSM Code's own online index, hosted by the Asian Development Bank-funded Legal Information System at fsmlaw.org, is an unofficial codification frozen at Public Law No. 12-12 of August 2001, and its 58 titles carry no Computer Crimes, Cybersecurity, or Electronic Transactions title or chapter as codified there; Title 11 (Crimes) stops at Chapter 12 (Sentencing) with no computer-offense chapter, and Title 21 (Telecommunications) as codified there holds only the original 2001-era Chapter 1 (General Provisions) and Chapter 2 (Telecommunications Corporation).
Because that codification is stale, the national legislature's own current public-law and bill archive at the Congress of the Federated States of Micronesia's website (cfsm.gov.fm) was searched instead.
Two companion bills were introduced in the Twenty-Third Congress on : C.B. No. 24-15 would add a new Chapter 13 to Title 11 defining cybercrime offenses such as unauthorized access, computer-related fraud, and cyberstalking, an intruder-offense bill this jurisdiction's scraping row already names; and C.B. No. 24-14 (the Cybersecurity Act 2025), researched here, would add a new Chapter 4 to Title 21 establishing a critical-information-infrastructure cybersecurity framework, a National Cybersecurity Committee, and a national Computer Emergency Response Team (CERT-FSM).
No further search of the 18th through 23rd Congresses' enacted public-law titles surfaced any other cybersecurity, data-protection, or electronic-transactions statute; the only enacted operator-facing security duty found is Public Law No. 18-52 (2014), the 'FSM Telecommunications Act of 2014,' inserted as a new Chapter 3 of Title 21, and section 349(1)(b) of that chapter is this jurisdiction's telecommunications-safeguards instrument below.
No comprehensive data-protection or breach-notification statute exists for this jurisdiction's privacy row to carry a security-of-processing clause from, so there is no Test 2 seam to defer to here.
C.B. No. 24-14's Subchapter III (sections 407 through 412) creates the operator-facing duties set out as two proposed instruments below, one for the risk-management measures a critical-information-infrastructure owner must implement and one for the incident-reporting clock the same owner must meet.
Title 21's older Chapter 2 (Telecommunications Corporation) and the enacted Chapter 3 survive alongside the bill's proposed Chapter 4, so the Federated States of Micronesia Telecommunications Corporation, the Chapter 2 incumbent operator, continues to hold its own separate statutory powers; whether it is itself a Chapter 3 licensee bound by section 349(1)(b) is not established in the text located here and is recorded as an open question on that instrument.
C.B. No. 24-14's Subchapter V would separately require a person providing an accreditable cybersecurity service, such as a security operations center or penetration-testing service, to hold an accreditation from an officer the Secretary of Justice appoints; that duty binds a narrow class of security vendor this corpus's activity vocabulary cannot yet express, so it is named here in prose rather than filed as an instrument, the same treatment already given Vanuatu's near-identical cybersecurity service-permit regime.
Section 27 of the bill would delay Subchapter V's own commencement until the Secretary of Justice promulgates implementing regulations, later than the rest of the chapter's ordinary commencement on presidential approval.
Section 382 of the enacted Telecommunications Act of 2014 separately criminalizes unauthorized access to a communications facility, interception, and data damage or disruption, an intruder-offense chapter already within the scraping topic's computer-misuse family and not itself a security-topic duty on an operator or manufacturer.
No Central Bank or IT-risk directive for a licensed financial institution was located: the FSM Code's Title 29 (Commercial Banking), Chapter 6 (Regulation and Supervision of Banks, sections 601-627), uses the word 'security' only for loan collateral and carries no confidentiality, safeguards, or cyber provision, and no public website for a Federated States of Micronesia Banking Board or equivalent financial regulator could be located to check for a lower-visibility prudential directive (a guessed domain returned no DNS record), so that remains an open research gap rather than a confirmed absence.
Whether the World Bank, the Pacific Islands Forum, SPC, or the ITU assisted in drafting C.B. No. 24-14 was not established in the sources checked; that absence rests on the primary sources browsed directly, since a broader web search could not be run, so it is an open gap rather than a settled absence.
Several sources returned no usable text: fsmtc.fm (the Telecommunications Corporation's own site) and fsmgov.org each served only a JavaScript shell on both the compliant and browser tiers; the FSM Congress's legacy fsmcongress.fm domain failed with a certificate hostname mismatch at the TLS layer on every scheme tried, a genuine site-side misconfiguration rather than a bot wall, which is why the current cfsm.gov.fm domain was used instead; PacLII's Federated States of Micronesia index returned a Cloudflare CAPTCHA challenge, a stop rather than a wall to read past; and no working WIPO Lex jurisdiction profile page for the Federated States of Micronesia could be located by direct URL, so the cross-check used for other jurisdictions in this corpus is unavailable here.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
C.B. No. 24-14 (Cybersecurity Act 2025), introduced in the Congress of the Federated States of Micronesia, would add a new Chapter 4 to Title 21 whose purpose is to establish a legal framework to prioritize cybersecurity as a means to advance the national policy to strengthen and maintain secure, functioning, and resilient critical information infrastructure in the Federated States of Micronesia.
Section 407 would let the Secretary of Justice designate a computer, computer system, or computer data as critical information infrastructure by written order to its owner. Section 407(1)(a) requires that the computer or computer system be necessary for the continuous delivery of an essential service, and section 407(1)(b) separately requires that its loss or compromise could significantly degrade, impede, disrupt, or otherwise adversely impact delivery of that service.
Section 408(1) would make the owner of critical information infrastructure responsible for implementing technical, operational, and organizational measures to manage cybersecurity risks and to prevent or mitigate the impact of a cybersecurity incident or threat.
Section 408(2)(a) requires a cybersecurity risk assessment of critical information infrastructure at least every two years, alongside an internal cybersecurity policy, an internal incident-reporting policy, and an internal cybersecurity awareness program.
Section 409(1) would let the Secretary require the owner to provide information on the design, configuration, and security of critical infrastructure, and section 410 would let the Secretary issue binding written directions to an owner or a class of owners to manage a cybersecurity threat or risk. Section 411 requires the relevant owner to notify the Department of Justice of a change of ownership or control within seven days.
A failure to comply with the owner's duties under section 408 is a criminal offense carrying a fine of up to $10,000 or imprisonment of up to one year or both, and section 419 would let the Secretary exempt any person or class of persons from all or part of these obligations. The bill was introduced in the Congress of the Federated States of Micronesia on .
Section 349(1) of Title 21, inserted by Public Law No. 18-52 (2014), the 'FSM Telecommunications Act of 2014', binds a telecommunications licensee with two duties under the same subsection. Paragraph (a) bars collecting, using, maintaining, or disclosing information about a customer without the customer's consent, a duty this jurisdiction's privacy row researches.
Paragraph (b), researched here, separately requires the licensee to apply appropriate security safeguards to prevent the collection, use, maintenance or disclosure of that information without the customer's consent.
Section 383's general offence provision makes a contravention of any provision of the Act, including section 349(1)(b), a criminal offence, and section 384 sets escalating fines and imprisonment for a natural person and a percentage-of-revenue fine for a corporation or other entity, with an added daily fine for a continuing violation.
Section 387 lets the Attorney General appoint Special Assistant Attorneys General to prosecute offences under the Act, and no civil action or private right of action for a customer harmed by a safeguards failure was found; a customer's recourse instead runs through the Telecommunication Regulation Authority's own consumer complaint and dispute process. Public Law No. 18-52 gave this new chapter of Title 21 the short title 'FSM Telecommunications Act of 2014'.
Section 94 of Public Law No. 18-52 sets its own effective date as the date of presidential approval, dated .
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
Section 412(1) of the same bill, C.B. No. 24-14 (Cybersecurity Act 2025), would require the owner of critical information infrastructure to notify the Secretary of Justice and the CERT-FSM (the national Computer Emergency Response Team the bill would create) of a significant cybersecurity incident affecting its critical information infrastructure or an interconnected system. The owner must submit an early warning within twenty-four hours of becoming aware of the incident.
The owner must then submit a fuller incident notification within seventy-two hours. The owner must submit a final report not later than thirty days after that notification, and, for an ongoing incident, a progress report on the same thirty-day clock. Section 412(3) would separately require the owner to establish mechanisms and processes for promptly detecting a cybersecurity threat or incident affecting its critical information infrastructure.
A failure to comply with the reporting duty is a criminal offense carrying a fine of up to $10,000 or imprisonment of up to one year or both. The bill was introduced in the Congress of the Federated States of Micronesia on .
The Federated States of Micronesia has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no hot-news or misappropriation doctrine, no reported case on hyperlinking or framing, and no text-and-data-mining-specific exception or opt-out mechanism.
The general fair-use exception of the FSM Copyright Act (Title 35, Chapter 1 of the Code) reaches an aggregator's reproduction of a headline or short extract to the extent the use is for criticism, comment, news reporting, or a similarly weighed purpose, and a compilation of headlines or extracts is itself protectable as an original work of authorship only for the aggregator's own selection and arrangement, not for the underlying material aggregated.
Section 107 of the FSM Copyright Act exempts the fair use of a copyrighted work, including reproduction, for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, from copyright infringement, weighed against the purpose and commercial character of the use, the nature of the work, the amount used relative to the whole, and the effect on the work's potential market.
Section 101 defines a compilation as an original work of authorship where preexisting material or data is selected, coordinated, or arranged, and section 103 confines a compilation's protection to the compiler's own contribution rather than the underlying material assembled into it. No statement of the day the Act came into force has been located.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
The Federated States of Micronesia has no AI-transparency, output-labeling, or other AI-specific statute. The full title index of the Code of the Federated States of Micronesia (Annotated), checked directly, contains no title addressing artificial intelligence, automated decision-making, or synthetic content, and no bill of that kind is before the 24th Congress.
FSM Congress Bill C.B. No. 24-14 (Cybersecurity Act 2025) and C.B. No. 24-17 (Personal Data Protection Act of 2025) are both pending reforms touching digital regulation generally, but neither addresses an AI system, a chatbot disclosure, or synthetic-content labeling; the first would regulate the cybersecurity practices of designated critical-information-infrastructure owners, and the second would bind only core National Government departments and agencies collecting personal data.
As of .
Age gating law
The Federated States of Micronesia has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
The full title index of the Code of the Federated States of Micronesia (Annotated), checked directly, contains no title addressing online services, internet access, or a minor's use of digital platforms, and the national Crimes title (Title 11) has no chapter on sexual offenses or child protection at all; general criminal law of that kind falls to the four FSM states under the Constitution's division of national and state legislative power, so a national-level statute would not be the place such a duty would appear even if one existed. No bill of this kind is before the 24th Congress.
As of .
Case law
No current case law for Micronesia AI law
No current case law for Micronesia privacy law
No current case law for Micronesia scraping law
No current case law for Micronesia cybersecurity law
No current case law for Micronesia communications law
No current case law for Micronesia content moderation law
No current case law for Micronesia product and AI liability law
No current case law for Micronesia digital accessibility law
No current case law for Micronesia age gating law
No current case law for Micronesia reuse law
Reporting clocks that run here1 instrument
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Micronesia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the Secretary of Justice and the CERT-FSM of a significant cybersecurity incident affecting your critical information infrastructure or an interconnected system: an early warning within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within 30 days of that notification.
For an ongoing significant cybersecurity incident, submit a progress report to the Secretary of Justice and the CERT-FSM within 30 days of the notification, and a final report within 30 days of the handling of the incident (Section 412(2)(d)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
